Loading page…
A small classifier for attempts to override instructions, distinct from a general harmful-content moderator.
Prompt Guard fits where an assistant encounters instructions from sources that should not control it. Its role is to signal a possible instruction attack. That signal can help route or quarantine content, while application permissions contain what any successful attack could do.
Prompt Guard 2 labels content benign or malicious, focusing on explicit attempts to override instructions. Unlike the first generation, it does not provide a separate injection label.
Source: Meta · Llama Prompt Guard 2 model cardThe card specifies a 512-token window and 22M/86M variants. It reports weaker multilingual performance for the smaller model and warns about adaptive and application-specific attacks.
Source: Meta · Llama Prompt Guard 2 model cardOur recommendation: test your document splitting strategy, including instructions spanning two chunks. A classifier that sees only excerpts may miss how a document changes the meaning of an instruction.
An assistant reads a support ticket containing quoted instructions from an attacker. A detector can flag the suspicious passage, but a security analyst may legitimately need to read it. Keep analysis possible while withholding unrelated email-sending authority.
Malicious here describes an instruction-override pattern, not proof of harmful content or a successful attack. A benign label is not authorization to execute a tool call.
How to read an AI safety evaluationThe sources behind this page, with a reason to open each one. Practical examples and recommendations are our editorial interpretation.
Explains binary attack detection, the 512-token window and differences between the 22M and 86M versions.
Threat examples and layered defenses for applications that process untrusted text.
Sources reviewed 13 September 2026. Product documentation can change. How we use evidence